本文提出了一種新的過(guò)濾SYN 洪水攻擊的方法。這種方法（故意丟棄過(guò)濾）通過(guò)觀
察客戶的協(xié)議一致性行為判定客戶的請(qǐng)求是否正常。它的主要思想是故意丟棄每個(gè)連接請(qǐng)求上的第一個(gè)SYN 數(shù)據(jù)包，后續(xù)的SYN 只有遵守TCP 超時(shí)與重傳機(jī)制才能通過(guò)。分析表明，我們的方法能有效地降低攻擊的成功率，同時(shí)連接建立的延遲也是可以接受的。
關(guān)鍵字：SYN 洪水；超時(shí)與重傳機(jī)制；協(xié)議一致性；故意丟棄；邊界路由器
Abstract: This paper presents a novel scheme for filtering SYN flooding attacks.
The scheme (Purposive Discarding based Filtering) decides whether the client’s
request is legitimate or not by observing client’s protocol consistency behavior.
The main idea is to purposely discard the first SYN packet of each connection request.
Subsequent SYN packet from a request is passed only if it adheres to the TCP’s
timeout and retransmission mechanism. Our analysis shows that the proposed scheme
reduces the attacker’s successful attack rate significantly with an acceptable
increase in connection establishment delay.
Keyword: SYN flooding; timeout and retransmission mechanism; protocol consistency;
purposive discarding; edge router